[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-572702-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-572702-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","search-operators-parsing-aggregating-help-docs","SEARCH OPERATORS - Parsing - Aggregating - Help Docs","","Search operators cheatsheet covering parsing and aggregating patterns for log queries. Includes examples using parse regex, field extraction, CSV and hex/number conversions, anchoring, date and formatting helpers, geo lookup and distance calculations, conditional expressions, filtering, joining streams, and string/field utilities. Also provides statistical aggregations like avg, count variants, most/least recent, percentile formatting, sum/min/max, fillmissing, and time-window functions such as timeslice, accum, and backshift. References Sumo help docs for further guidance.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/search-operators-parsing-aggregating-help-docs/572702/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/search-operators-parsing-aggregating-help-docs/572702.png","ImageObject",442,249,{"name":42,"@type":43},"Sophia Brooks","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-21","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",7,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What parsing functions are listed for extracting fields from text or logs?","Question",{"text":63,"@type":64},"The document lists parse regex with named captures, parse regex with field=url, parseHex/hexToDec/decToHex conversions, parseDate, geo lookup parsing, JSON/XML parsing, keyvalue inference, and split/keyvalue-style extraction examples.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"Which aggregation operators are provided for summarizing metrics over time or groups?",{"text":68,"@type":64},"It includes avg, count/count_distinct/count_frequent, most_recent and least_recent, first and last, fillmissing, min/max, pct, stddev, sum, and specialized time-series functions like accum, backshift, smooth, rollingstd.",{"name":70,"@type":61,"acceptedAnswer":71},"How does the cheat sheet reference time handling and query ranges?",{"text":72,"@type":64},"It shows timeslice for bucketing, queryStartTime/queryEndTime/queryTimeRange for retrieving time bounds, and examples using logcompare with timeshift (e.g., -24h) to compare time-shifted results.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},572702,1792014486,{"code":4,"msg":82,"data":83},"success",[84,88,93,98,103,108,113,118,123],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":86,"slug":87},11,90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":125,"show_sort_weight":4,"slug":126},158,"General","general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":85,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":33,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":26},962084925636,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","SEARCH OPERATORS  \nPARSING  \nparse regex  \n| parse regex \"[0-9A-Za-z-]+\\ . (?\u003Cdomain>[A-Za-z-]+\\ . (?: co\\ . uk|com| com\\ . au))/ . *\"Field Option  \n| parse regex field=url \"[0-9A-Za-z-]+\\ . (?\u003Cdomain>[A-Za-z-]+\\ . (?: co\\ . uk|com| com\\ . au))/ . *\"  \ncsv  \n| csv _ raw extract 1 as user  \nparseHex  \n| parseHex(\"12D230\") as decimalValue  \nparse (anchor)  \n| parse \"User=*:\" as user  \nField Option  \n| parse field=xyz \"User=*:\" as user Nodrop Option  \n| parse \"a=*,\" as a nodrop  \nsplit  \n| split text delim=':' extract 1 as user,  \n2 as account_id, 3 as session_id, 4 as result  \nkeyvalue  \n| keyvalue infer \"module\", \"thread”  \nJSON  \n| json field=jsonobject \"sessionId\"or  \n| json auto  \nxml  \n| parse XML \"/af/@type\"  \nparseDate  \n| parseDate(strDate, dateFormat)  \n| parseDate(strDate, dateFormat, timeZone)  \nAGGREGATING  \navg  \n| avg(request_received) by hour  \ncount, count_distinct, and count_frequent  \n| count by url  \n| count_distinct(username) by hostname  \n| count_frequent srcIP, url  \nmost_recent and least_recent  \n| [parse ... as](parse ... as) status | withtime status | most_recent(status_withtime) by _sourcehost  \n| [parse ... as](parse ... as) status | withtime status | least_recent(status_withtime)  \nby _sourcehost  \nfirst and last  \n| first(error_message) by hostname | last(error_message) by fieldname  \nfillmissing  \n| fillmissing values(\"backend\", \"database\",\"webapp\") in _sourceCategory  \nmin and max  \n| max(request_received) by hour  \n| min(request_received) by hour  \npct  \n| pct(value, 95) as value_ 95pct  \nstddev  \n| stddev(request_received) by hour  \nsum  \n| sum(bytes_received) by hostname  \nSUMO HELP DOCS: [https://help.sumologic.com](https://help.sumologic.com)  \nSEARCH OPERATORS  \naccum  \n| count as requests by _timeslice,cs_username | sort by _timeslice asc,cs_username  \n| accum requests as running_total  \n(as) operator  \n| parse \"* - - \" as ip_addr | ip_addr as src_ip  \nbase64Encode  \n| base64Encode (\"hello world\") as base64  \nbackshift  \n| count by _timeslice  \n| sort + _timeslice  \n| backshift _count,10 as size  \nbase64Decode  \n| base64Decode(\"aHR0cDovL2NvZGVjLmFw YWNoZS5vcmcvY29tbW1vbnM=\") as V  \nCIDR  \n| where compareCIDRPrefix(\"10 . 10 . 1 . 32\", ip_address, toInt(27))| where getCIDRPrefix(\"10 . 10 . 1 . 35\", toInt(24))`| maskFromCIDR(toInt(24)) as s`  \nconcat  \n| concat(field1, field2, field3) as new_string  \ncontains  \n| contains(\"hello world\", \"hello\") as containing`  \ndecToHex  \n| decToHex(\"4919\") as V  \ndi􀀞  \n| diff bytes as diff_bytes  \nfields  \n| fields method, status_code  \nfilter  \n_sourceCategory=[HttpServers | timeslice](HttpServers | timeslice) 1m | count by _timeslice, _sourceHost | filter _sourcehost in (outlier _count by _sourceHost | where _count_violation > 0) | transpose row _timeslice column _sourcehost  \nformat  \n| parse \"fiveMinuteRate=*,\" as rate  \n| format(\"%s : %s\",\"Five Minute Rate is\" , rate) as formattedVal  \nformatDate  \n| formatDate(now(), \"YYYY-MM-dd\") as today  \ngeo lookup  \n| parse \"remote_ip=*]\" as remote_ip  \n| lookup latitude, longitude, country_code, country_name, region, city, postal_code, area_code, metro_code from geo://default on ip = remote_ip | count by latitude, longitude, country_code, country_name, region, city, postal_code, area_code, metro_code  \n| sort _count  \nhaversine  \n| haversine(39 . 04380, -77 . 48790, 45 . 73723, -119 . 81143) as distanceKMs  \nhexToDec  \n| hexToDec(\"0000000000001337\") as V  \nif  \n| if(status_code matches \"5*\", 1, 0) as server_error Or  \n| status_code matches \"5*\" ? 1 : 0 as server_error  \n?  \n| status_code matches \"5*\"? 1 : 0 as server  error  \nin  \n| if (status_code in (\"500\", \"501\", \"502\",\"503\", \"504\", \"505\", \"506\", \"401\", \"402\",\"403\", \"404\"), \"Error\", \"OK\") as status_code_type  \nipv4ToNumber  \n| ipv4ToNumber(ip) as num  \nisBlank  \n| where isBlank(user)  \nisEmpty  \n| if(isEmpty(src_ip),1,0) as null_ip_counts  \nisNull  \n| where isNull(src_ip)  \nisNumeric  \n| where isNumeric(num)  \nisPrivateIP  \n| where isPrivateIP(src_ip)  \nisPublicIP ","cbCaisoY34NGTF6y","https://ap.wps.com/l/cbCaisoY34NGTF6y","pdf",717370,"English","# SEARCH OPERATORS\n## PARSING\n## AGGREGATING","[{\"question\":\"What parsing functions are listed for extracting fields from text or logs?\",\"answer\":\"The document lists parse regex with named captures, parse regex with field=url, parseHex/hexToDec/decToHex conversions, parseDate, geo lookup parsing, JSON/XML parsing, keyvalue inference, and split/keyvalue-style extraction examples.\"},{\"question\":\"Which aggregation operators are provided for summarizing metrics over time or groups?\",\"answer\":\"It includes avg, count/count_distinct/count_frequent, most_recent and least_recent, first and last, fillmissing, min/max, pct, stddev, sum, and specialized time-series functions like accum, backshift, smooth, rollingstd.\"},{\"question\":\"How does the cheat sheet reference time handling and query ranges?\",\"answer\":\"It shows timeslice for bucketing, queryStartTime/queryEndTime/queryTimeRange for retrieving time bounds, and examples using logcompare with timeshift (e.g., -24h) to compare time-shifted results.\"}]","SEARCH OPERATORS - Parsing - Aggregating - Help Docs | PDF",1791928935]